# Cloudflare Pages headers for Wrexlyn Workspace — by Nishant Prabhakar
# Pages run only Wrexlyn's own code plus six pinned, integrity-checked Office libraries, talk only to the
# engines the user connects (and Wrexlyn on their own PC), and load nothing from any other third party.
# The bridge (bridge.js) sends this same Content-Security-Policy for the pages it serves.
/*
  Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.jsdelivr.net/npm/pptxgenjs@4.0.1/dist/pptxgen.bundle.js https://cdn.jsdelivr.net/npm/exceljs@4.4.0/dist/exceljs.min.js https://cdn.jsdelivr.net/npm/pdfmake@0.2.23/build/pdfmake.min.js https://cdn.jsdelivr.net/npm/pdfmake@0.2.23/build/vfs_fonts.js https://cdn.jsdelivr.net/npm/mammoth@1.13.0/mammoth.browser.min.js https://cdn.jsdelivr.net/npm/jszip@3.10.1/dist/jszip.min.js; style-src 'self'; style-src-attr 'unsafe-inline'; font-src 'self'; img-src 'self' data: blob:; connect-src 'self' https://cdn.jsdelivr.net/npm/pptxgenjs@4.0.1/dist/pptxgen.bundle.js https://cdn.jsdelivr.net/npm/exceljs@4.4.0/dist/exceljs.min.js https://cdn.jsdelivr.net/npm/pdfmake@0.2.23/build/pdfmake.min.js https://cdn.jsdelivr.net/npm/pdfmake@0.2.23/build/vfs_fonts.js https://cdn.jsdelivr.net/npm/mammoth@1.13.0/mammoth.browser.min.js https://cdn.jsdelivr.net/npm/jszip@3.10.1/dist/jszip.min.js https://api.anthropic.com https://api.openai.com https://api.deepseek.com https://api.groq.com https://openrouter.ai https://generativelanguage.googleapis.com https://api.cerebras.ai https://api.mistral.ai https://api.github.com https://wrexlyn-license-server.onrender.com http://127.0.0.1:4395 http://localhost:4395; worker-src 'self' blob:; manifest-src 'self'; frame-src 'self' blob:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; object-src 'none'
  X-Content-Type-Options: nosniff
  Referrer-Policy: no-referrer
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()
  X-Frame-Options: DENY
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Cross-Origin-Opener-Policy: same-origin
  Cross-Origin-Resource-Policy: same-origin
  ! Access-Control-Allow-Origin

/sw.js
  Cache-Control: no-cache

# The Office add-in runs inside Excel and PowerPoint: it loads Office's own script, may be framed by Office on the
# web, and talks only to Wrexlyn on this PC.
/office/*
  ! Content-Security-Policy
  ! X-Frame-Options
  ! Cross-Origin-Opener-Policy
  Content-Security-Policy: default-src 'self'; script-src 'self' https://appsforoffice.microsoft.com; style-src 'self'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://appsforoffice.microsoft.com http://127.0.0.1:4395 http://localhost:4395; frame-src https://appsforoffice.microsoft.com; base-uri 'none'; form-action 'none'; object-src 'none'; frame-ancestors 'self' https://*.officeapps.live.com https://*.office.com https://*.office365.com https://*.microsoft365.com https://*.sharepoint.com https://*.cloud.microsoft
  Cache-Control: no-cache

/office/manifest.xml
  Content-Type: application/xml; charset=utf-8
  Content-Disposition: attachment; filename="wrexlyn-office-manifest.xml"

/index.html
  Cache-Control: no-cache

/desktop/
  Cache-Control: no-cache

/desktop/index.html
  Cache-Control: no-cache

/fonts/*
  Cache-Control: public, max-age=31536000, immutable
